bgpd: fix double free in dampening code

bgp_damp_info_unclaim already calls bgp_reuselist_del. We must not call
it again here.

Fixes #9046.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>

diff --git a/bgpd/bgp_damp.c b/bgpd/bgp_damp.c
index 40fe5b8b5910be2fe5079f9bc6ef97055b391337..08859324af11f2d957baff404cefcb98b301e573 100644 (file)
--- a/bgpd/bgp_damp.c
+++ b/bgpd/bgp_damp.c
@@ -157,16 +157,9 @@ static void bgp_reuse_list_add(struct bgp_damp_info *bdi,
 }
 
 /* Delete BGP dampening information from reuse list.  */
-static void bgp_reuse_list_delete(struct bgp_damp_info *bdi,
-                                 struct bgp_damp_config *bdc)
+static void bgp_reuse_list_delete(struct bgp_damp_info *bdi)
 {
-       struct reuselist *list;
-       struct reuselist_node *rn;
-
-       list = &bdc->reuse_list[bdi->index];
-       rn = bgp_reuselist_find(list, bdi);
        bgp_damp_info_unclaim(bdi);
-       bgp_reuselist_del(list, &rn);
 }
 
 static void bgp_no_reuse_list_add(struct bgp_damp_info *bdi,
@@ -358,7 +351,7 @@ int bgp_damp_withdraw(struct bgp_path_info *path, struct bgp_dest *dest,
        if (CHECK_FLAG(bdi->path->flags, BGP_PATH_DAMPED)) {
                /* If decay rate isn't equal to 0, reinsert brn. */
                if (bdi->penalty != last_penalty) {
-                       bgp_reuse_list_delete(bdi, bdc);
+                       bgp_reuse_list_delete(bdi);
                        bgp_reuse_list_add(bdi, bdc);
                }
                return BGP_DAMP_SUPPRESSED;
@@ -402,7 +395,7 @@ int bgp_damp_update(struct bgp_path_info *path, struct bgp_dest *dest,
        else if (CHECK_FLAG(bdi->path->flags, BGP_PATH_DAMPED)
                 && (bdi->penalty < bdc->reuse_limit)) {
                bgp_path_info_unset_flag(dest, path, BGP_PATH_DAMPED);
-               bgp_reuse_list_delete(bdi, bdc);
+               bgp_reuse_list_delete(bdi);
                bgp_no_reuse_list_add(bdi, bdc);
                bdi->suppress_time = 0;
                status = BGP_DAMP_USED;